feat(network-proxy): add policy-backed DNS service

codex-rs/Cargo.toml

@@ -322,6 +322,7 @@ gethostname = "1.1.0"
 gix = { version = "0.81.0", default-features = false, features = ["sha1"] }
 glob = "0.3"
 globset = "0.4"
+hickory-proto = { version = "0.25.2", default-features = false, features = ["std"] }
 hmac = "0.12.1"
 http = "1.3.1"
 httpdate = "1.0.3"

codex-rs/network-proxy/Cargo.toml

@@ -21,6 +21,7 @@ codex-utils-absolute-path = { workspace = true }
 codex-utils-home-dir = { workspace = true }
 codex-utils-rustls-provider = { workspace = true }
 globset = { workspace = true }
+hickory-proto = { workspace = true }
 rand = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }

codex-rs/network-proxy/src/attribution.rs

@@ -72,16 +72,19 @@ where
 }
 
 async fn read_attribution_token(stream: &mut TcpStream) -> Result<Option<String>, BoxError> {
-    let mut marker = [0_u8; 1];
-    let read = stream.stream.peek(&mut marker).await?;
-    if read == 0 {
-        return Err(io::Error::new(io::ErrorKind::UnexpectedEof, "empty proxy connection").into());
-    }
-    if marker[0] != ATTRIBUTION_FRAME_MAGIC[0] {
-        return Ok(None);
-    }
+    Ok(tokio::time::timeout(ATTRIBUTION_FRAME_TIMEOUT, async {
+        let mut marker = [0_u8; 1];
+        let read = stream.stream.peek(&mut marker).await?;
+        if read == 0 {
+            return Err(io::Error::new(
+                io::ErrorKind::UnexpectedEof,
+                "empty proxy connection",
+            ));
+        }
+        if marker[0] != ATTRIBUTION_FRAME_MAGIC[0] {
+            return Ok(None);
+        }
 
-    let token = tokio::time::timeout(ATTRIBUTION_FRAME_TIMEOUT, async {
         let mut magic = [0_u8; ATTRIBUTION_FRAME_MAGIC.len()];
         stream.read_exact(&mut magic).await?;
         if &magic != ATTRIBUTION_FRAME_MAGIC {
@@ -100,22 +103,21 @@ async fn read_attribution_token(stream: &mut TcpStream) -> Result<Option<String>
         }
         let mut token = vec![0_u8; token_len];
         stream.read_exact(&mut token).await?;
-        String::from_utf8(token).map_err(|_| {
+        let token = String::from_utf8(token).map_err(|_| {
             io::Error::new(
                 io::ErrorKind::InvalidData,
                 "network proxy attribution token is not UTF-8",
             )
-        })
+        })?;
+        Ok(Some(token))
     })
     .await
     .map_err(|_| {
         io::Error::new(
             io::ErrorKind::TimedOut,
             "network proxy attribution frame timed out",
         )
-    })??;
-
-    Ok(Some(token))
+    })??)
 }
 
 /// Writes the trusted bridge preface consumed by the shared proxy ingress.